Privacy Policy

Your personal data privacy and trust are of crucial importance to us and the success of our business. We collect information about our clients and here we will outline the type of information we gather, the reasons we do so and what we do with it. You’ll also be able to see how you can modify any information you entrust to us.
KRAPOV & PARTNERS LAW FIRM, UIN (BULSTAT) 175018700, is registered at Sofia City Court under company file 11491/2005 in the register of law companies under № 35, tome 2, page 14, having its registered office at Sofia, 8-10 Stara planina Str., fl. 2, office 7, phone: + 359 2 980 27 30, +359 2 9813620, email:, represented by Ivan Todorov Krapov.
In order the clients to obtain the legal services provided by us, we obtain, hold and process personal data. This notice outlines how we manage such information to ensure we meet our obligations to respect our customers’ privacy and that all such information remains confidential.
KRAPOV & PARTNERS LAW FIRM is a personal data controller following the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – General Data Protection Regulation (GDPR) and Bulgarian Personal Data Protection Act.

I. How you can contact KRAPOV & PARTNERS LAW FIRM
If you have any questions about your privacy rights, you can contact us in the following ways:
• In person or by registered mail: Address Sofia 1000, Bulgaria, Oborishte District, 8 -10 Stara planina Str., fl. 2, office 7;
• By contacting us on our website, section “Contacts”
• By contacting us on the following phone + 359 2 980 27 30, +359 2 9813620;
• By email at:
If you are not satisfied with a response you receive from us, you are entitled to lodge a complaint with the Office of the Data Protection Commission:
• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
• Tel. +359291-53-518
• Reception hall – working hours 9:00 – 17:30
• Е-mail:
• Website:
You can visit the website of the Office of the Data Protection Commission for Republic of Bulgaria at for more details.

II. How and why we use your personal data
We collect and process personal data only subject to the requirements of local and European legislation. We understand that processing your personal data is for a specific reason and cannot be done without limitation.
We gather and process your personal data for a variety of reasons and rely on a number of different legal bases to use that information, for example, we use your personal data information to provide you with legal advice and legal services, to ensure we provide you with the best service possible, to prevent unauthorised access to your personal data and to meet our legal and regulatory obligations.
This Data Protection Notice is intended to explain to you how and why we process your personal data.
1. For fulfilment of a contract or in the context of pre-contractual relations.
Before we provide you with services and advices, we have to gather some personal data to process your requests. This includes, for instance, gathering and processing personal information including to your names, phone number, address, e-mail address, identification number (PIN, PNF, etc.)
The purpose for the collection of this information is to identify you as prospective clients, to answer your questions, to provide you with the services you requested from us and to fulfil the contract undersigned with you.
If you choose not to provide some information, this may mean that we cannot provide you with the service you have requested, so we are not able provide you with the assist you require.
We keep the information as up to date as possible, and will change any details, such as your phone number or address, promptly when you inform us that they have changed.
2. To comply with legal obligations.
We are required to process your personal information to comply with certain legal obligations, for example:
• For provision of information to the Data Protection Commission in connection with obligations provided by the legislation on the protection of personal data – Data Protection Act, Regulation (EC) 2016/679 of 27 April 2016 and others;
• Obligations stipulated in the Accountancy Act and the Tax and Social Insurance Procedure Code and other related normative acts in connection with the maintenance of proper and lawful accounting;
• Obligations stipulated in the Attorneys Act and the Anti Money Laundering Act;
• Providing information to a court and third parties, in the course of proceedings before a court, in accordance with the requirements of procedural and substantive applicable legal acts;
3. Where you have provided consent.
In some cases, we process your personal data only upon your prior consent. The consent is a separate reason for processing of your personal data and the purpose of the processing is specified therein.

III. What kind of information KRAPOV & PARTNERS LAW COMPANY collects and how it is used
The information we collect and hold about you includes: name, address, e-mail, personal identification number (PIN, PNF, etc.), participations in companies, non-profit legal entities or forms of associations, ownership of real estates, effects or securities, employment status, status on contracts concluded by you, your relations with third parties etc.
We will require this information from you through: our website, as well as personally by you when you visit us at the following address: Address Sofia 1000, Bulgaria, Oborishte District, 8 – 10 Stara planina Str., fl. 2, office 7.
We collect information also indirectly via the use of cookies, which are outlined below in the Notice.
KRAPOV & PARTNERS LAW FIRM does not have clients and does not collect personal data on children aged under 18.

IV. You can control the personal information you have given to KRAPOV & PARTNERS LAW FIRM
When your personal data is processed in connection with our services, you are entitled to rely on a number of rights. These rights allow you to exercise meaningful control over the way in which your personal data is processed. You may execute any of these rights free of charge (in certain exceptional circumstances a reasonable fee may be charged or we may refuse to act on the request) and we may ask you to verify your identity prior to proceeding with your instruction by way of requesting additional information/documentation from you. Once we are satisfied that we have effectively verified your identity, we will respond to the majority of requests without undue delay and within a one month period. KRAPOV & PARTNERS LAW FIRM will action your request to have your personal data corrected within 10 calendar days. These periods may be extended in exceptional circumstances and we will inform you where the extended period applies to you along with an explanation of the reasons for the extension.
You are entitled to:
1. Access your personal data:
You can access the personal data we hold about you by contacting us with a data access request, using our website, as well as by visiting us at the following address: Address Sofia 1000, Bulgaria, Oborishte District, 8-10 Stara Planina Str., fl. 2, office 7, and after we are assured that the request comes from you.
2. Correct/ restrict /delete your personal data
If you believe that certain personal data we hold about you is inaccurate or out of date, you can look for the data to be corrected at any time by visiting us at the following address: Sofia 1000, Bulgaria, Oborishte District, 8 - 10 Stara Planina Str., fl. 2, office 7, and after we are assured that the request comes from you.
If you dispute the accuracy of information held, you can request that we restrict processing this information while your complaint is being examined.
If you suspect that we are processing certain information without a legitimate reason, or that we are no longer entitled to use your personal data, you can also ask for that personal data to be deleted.
We are not under an obligation to delete your personal data where to do so would prevent us from meeting our contractual obligations to you, or where we are required or permitted to process your personal data for legal purposes or otherwise in accordance with our legal obligations.
There may be cases where the right of deletion cannot be exercised, and processing will be necessary:
• for the exercise of the right to free expression and the right to information;
• when this would prevent us from fulfilling our contractual obligations to you;
• to comply with a legal obligation that is subject to the law of the European Union or the Republic of Bulgaria that applies to us or to fulfil a task of the public interest or in the exercise of any public authority;
• to establish, exercise or protect legal claims.
You can request restricting of the processing data if:
• you object the accuracy of the personal data, for the period necessary for verification of its accuracy; or
• the processing of personal data is performed without a legitimate reason, but instead of deleting them, you want their limited processing; or
• we no longer need this data (for the intended purpose), but you need this data for the establishment, exercise or protection of legal claims; or
• You have objected to your personal data being processed, pending verification that the reasons for the data processor are legal.
We ask that you keep us informed of any relevant changes in your personal data to enable us to keep the data on our systems up to date and accurate.
3. Withdraw your consent
Whenever you have provided us with your consent to process your personal data, you have the right to withdraw that consent at any time through our website, as well as by visiting us at the following address Sofia 1000, Bulgaria, Oborishte District, 8 - 10 Stara Planina Str., fl. 2, office 7. If you withdraw your consent to process (and if there is no other justification for continuing to process your data), you are also entitled to request that your personal data is deleted. Withdrawing consent does not affect the lawfulness of any processing undertaken by us based on your consent before its withdrawal.
4. Objection to the processing of personal data
Our clients have the right, at any time and on grounds related to their particular situation, to object to the processing of personal data related to them.
If you disagree with the way in which we process certain data, you can object to this through our website, as well as by visiting us at the following address Sofia 1000, Bulgaria, Oborishte District, 8 - 10 Stara Planina Str., fl. 2, office 7, and after we ascertain that the request really comes from you. In such cases, we will provide you with details regarding the rationale for processing your personal data.
In certain cases, this right is unconditional, and we will always stop processing of the personal data upon objection by our clients.
In other cases, depending on the nature of the objection and the circumstances specified by the client, we will conduct an internal investigation of the received objection and will pronounce on it in accordance with this section, such as:
• We inform the client, that we shall stop the processing of his personal data;
• We send a motivated refusal why we shall not stop the processing of his personal data, if there is a legitimate reason for doing so.
5. Opportunity your personal data to be transferred in electronic form
You can (in certain cases) request that your personal data is transferred to you or another service provider or another data controller, so that you can store and reuse your personal data. We will not be in any way accountable or liable for any damage, loss or distress sustained, incurred or suffered by you and/or the designated service provider as a result of improper use of the personal data upon and after receipt from us.
6. Right to complain
If you believe that we are breaching the applicable legislation, please contact us to clarify the issue. Of course, you have the right to file a complaint with the Personal Data Protection Commission. After 25 May 2018, you will be able to file a complaint with a regulatory body within the EU.
7. How to exercise your rights
You can exercise the rights outlined above free of charge by contacting us through our website, as well as by visiting us at the following address Sofia 1000, Bulgaria, Oborishte District, 8 - 10 Stara Planina Str., fl. 2, office 7.
We recommend that you provide as much details as possible in your correspondence with us so that we can deal with your query promptly and efficiently. You may be asked to provide proof of identification and/ or additional information to validate your identity when making such a request.

V. Security and Confidentiality
We use a variety of security technologies and procedures to protect your personal data from unauthorised access, use or disclosure. We also take steps to ensure that only persons with appropriate authorisation can access your personal data.
We have in place systems and procedures to prevent unauthorised access, improper modification or disclosure, misuse or loss of information.
Only staff members who are suitably authorised can access your personal data if that data is relevant to the performance of their duties.
We use internal technical and organisational measures to protect your personal data from unauthorised access, to maintain data accuracy and to help ensure the appropriate use of your personal data.
We will not sell or hire your personal information to third parties for their own use.

VI. Cookies
What are cookies used for?
We use cookie technology on our website. We use cookies to collect information. A cookie is a small data file that a website stores on your computer’s hard disk to keep records of when you visit the website.
Cookies are also used in the preparation of anonymous statistics that help us understand how a certain user prefers to use our website, allowing us to improve its structure and content, excluding the identification of the personality of the user.
More information about this technology you can find in the section “Cookies”.

VII. Do we share your personal information?
We share your personal data with third parties-receivers and our primary purpose is to offer you qualitative, fast and comprehensive service by taking care of the services we offer to meet your expectations. We do not provide your personal data to third parties before we are sure that all technical and organisational measures have been taken to protect this data as we do strict control to meet this goal. In this case, we remain responsible for the confidentiality and security of your data.
We provide personal data to the following categories of recipients (personal data controllers):
• Employees and management staff of the company;
• Personal data processors;
• Authorities, institutions and persons to whom we are required to provide personal data under the current legislation.
The personal data processors are persons who process personal data on behalf and by assignment of KRAPOV & PARTNERS LAW FIRM on the basis of a written agreement. They are not entitled to process the personal data they have been provided for purposes different than the performance of the assigned by us. The data processors are obliged to observe all instructions received by KRAPOV & PARTNERS LAW FIRM.
We undertake the necessary measures, to ensure that the processors we have been engaged strictly comply with the personal data privacy regulations and our instructions, as well as they have been undertaken all appropriate technical and organizational measures for personal data protection.
Examples of processors of personal data:
• Courier Service Providers;
• Service Providers for implementation and / or maintenance of information systems, who may need an access to personal data, which are processed in the respective systems, for the purposes of the services providing;
• Postal operators;
• Banks providing payment services;
• Translation and legalization agencies;
• Persons providing accounting and other consulting services.
In some cases, we may obtain personal data, necessary for implementation the services and activities assigned by our clients. In these cases we process personal data in our capacity of personal data processor. As such, we understand our obligations to ensure the protection of the data provided, as we undertake the necessary measures for strict compliance with the data protection laws and the controller’s instructions.

VIII. How long will we retain your personal information?
How long certain personal information is stored depends on the nature of the information we hold and the purposes for which they are processed. As a rule, we stop using your personal data for the purposes of the contractual relationship after the termination of the contract with you, but we do not delete the data immediately.
KRAPOV & PARTNERS LAW FIRM determines appropriate retention periods as having regard to any statutory obligations imposed on us by law. As a rule, we stop the usage of your personal data, for the purposes related to the contractual relationship, after termination of the respective contract, but we do not delete the data until the termination of the contract or the final settlement of all financial obligations and the expiry of the statutory obligations to store the data, as obligations under the Attorney Act (5 years), under the Accountancy Law for the storage and processing of accounting data (50, 10 or 3 years), in certain cases settled in the Measures Against Money Laundering Act (5 years), the expiry of the limitation periods for making claims settled under the Law on Obligations and Contracts (5 years), obligations to provide information to the court, competent state authorities and other ground, settled in the current legislation (5 years)
You should note that we will not delete or anonymise your personal data if it is necessary for pending court, administrative proceedings or proceedings related to your complaint to us.
KRAPOV & PARTNERS LAW FIRM has put in place procedures to ensure that files are regularly purged and that personal information is not retained any longer than is necessary.

IX. Updates to our Data Protection Notice.
In order to apply the most up-to-date data protection measures and to comply with the current legislation, we will keep under regular review this Data Protection Notice. If the amendments we make are substantial, we can post a message about the changes on our website.
We invite you to review the current version of this Data Protection Notice, to be constantly informed about how we take care of the protection of the personal data we collect.
This Data Protection Notice has been updated for the last time on 23.05.2018.